Hacker claims 15M Trello client records exposed

Atlassian subsidiary and team management project tool provider Trello has reportedly been hacked into, exposing the personal data of possibly millions of clients.

The disclosure was shared on X, aka Twitter, by cyber watchdogs Hack Manac and Have I Been Pwned, on January 22nd. Trello has yet to comment but parent company Atlassian told Cybernews the cyber attacker may have worked off a separate list of email addresses, implying some kind of brute-force attack using data from another source.

The dark web posting claiming the attack, cited by Hack Manac and Have I Been Pwned, is self-credited to a malicious hacker who goes by the name of Emo. Assuming it’s true, it promises an emotional time for the people affected by the 15 million exposed records.

“Trello had 15M records scraped and posted for sale on a hacking forum last week,” said Have I Been Pwned. “Data included names, usernames, and email addresses from previous breaches used to enumerate Trello profiles.”

“The cybercriminal, who goes by the name 'Emo,' claims that the database includes emails, usernames, full names, and other account information,” confirmed Hack Manac.

The dark web posting shared on X by Emo claims 15,115,516 records. The cybercriminal is offering to sell a single copy of the data and has posted a sample.

Emo appears to have been active since at least June last year and has posted more than 200 times on its dark web account. It posted the claims about Trello on January 16th.

Acquired by Atlassian in 2017, Trello already claimed to have 4.75 million users a decade ago – the number could be far higher now, meaning that if it’s genuine, the Emo hack could have exposed vast numbers of people to follow-up crimes such as digital fraud.

At the time of writing, Trello has yet to confirm or deny the alleged incident. Its website indicates that “all systems [are] operational” and declares “no incidents reported” today or yesterday. Nor does its dedicated X profile mention anything about a data breach.

A spokesperson for parent company Atlassian told Cybernews: “We are aware of claims made by a threat actor about Trello user profile data. We completed an exhaustive investigation and have not found evidence to support that this data was gathered by unauthorized access.

“All evidence points to a threat actor testing a pre-existing list of email addresses against publicly available Trello user profiles. The security and privacy of our users' data is our highest priority, and we continue to monitor Trello closely for any unusual activity.”